Executive brief
MOOS core-moos is a middleware system for distributed software applications. The software fails to properly validate packet length declarations before allocating memory, allowing unauthenticated attackers to send crafted packets that trigger unbounded memory allocation and exhaust server resources, causing denial of service even before authentication is completed.
Technical details
The vulnerability is an unvalidated packet length allocation issue in the CMOOSCommPkt::OnBytesWritten() function. The code allocates memory based on a declared length field in incoming wire packets without proper validation of the claimed size, leading to unbounded buffer allocation. An unauthenticated attacker on the network can send specially crafted packets with arbitrarily large declared lengths to exhaust the server's available memory. This denial-of-service attack succeeds before client authentication completes, requiring no authentication or special privileges. The issue affects MOOS core-moos through version 10.4.0.
Affected products
- MOOS core-moos through 10.4.0
Timeline
- 2026-09-03: disclosed